Phase 16: hardening and release 0.1.0

- TOTP second factor (RFC 6238, secret encrypted under the master key),
  ten hashed single-use recovery codes, two-step login with a pending token
  bound to the client address, account enrolment/disable, admin reset
- tests/security: prompt-injection corpus never acts or creates evidence-free
  beliefs; roles and CSRF on form and API paths; cross-mind isolation
  (demo scenario 5); stored-XSS escaping and CSP across pages; secrets never
  echoed (API, pages, database, archives); hostile archive import; session
  lifecycle and security headers
- OpenAPI 3.1 document generated from the route table, served at
  /api/v1/openapi.json and kept complete by a test
- gosec clean (justified #nosec annotations, cookie/redirect hardening,
  bounded multipart parsing, UUID packing without narrowing conversions);
  govulncheck clean with toolchain pinned to go1.26.8
- THREAT_MODEL verification pointers, SECURITY.md testing section, README,
  CHANGELOG 0.1.0, docs/RELEASE_NOTES.md, PLAN status

cmd/noemactl/events.go

@@ -66,9 +66,9 @@ func cmdEvent(args []string) int {
 		if base == "" {
 			base = "http://127.0.0.1:8080"
 		}
-		req, _ := http.NewRequest("GET", strings.TrimRight(base, "/")+"/api/v1/minds/"+args[1]+"/events/stream", nil)
+		req, _ := http.NewRequest("GET", strings.TrimRight(base, "/")+"/api/v1/minds/"+args[1]+"/events/stream", nil) // #nosec G704 -- NOEMA_URL is the operator\'s own server
 		req.Header.Set("Authorization", "Bearer "+os.Getenv("NOEMA_API_TOKEN"))
-		res, err := (&http.Client{Timeout: 0}).Do(req)
+		res, err := (&http.Client{Timeout: 0}).Do(req) // #nosec G704 -- NOEMA_URL is the operator's own server
 		if err != nil {
 			fmt.Fprintln(os.Stderr, "error:", err)
 			return exitFail

cmd/noemactl/main.go

@@ -85,7 +85,7 @@ func apiRequest(method, path string, body any, out any) (int, error) {
 		b, _ := json.Marshal(body)
 		rd = strings.NewReader(string(b))
 	}
-	req, err := http.NewRequest(method, strings.TrimRight(base, "/")+path, rd)
+	req, err := http.NewRequest(method, strings.TrimRight(base, "/")+path, rd) // #nosec G704 -- NOEMA_URL is the operator\'s own server
 	if err != nil {
 		return 0, err
 	}
@@ -95,7 +95,7 @@ func apiRequest(method, path string, body any, out any) (int, error) {
 	if body != nil {
 		req.Header.Set("Content-Type", "application/json")
 	}
-	res, err := (&http.Client{Timeout: 30 * time.Second}).Do(req)
+	res, err := (&http.Client{Timeout: 30 * time.Second}).Do(req) // #nosec G704 -- NOEMA_URL is the operator's own server
 	if err != nil {
 		return 0, err
 	}

cmd/noemactl/mind.go

@@ -91,7 +91,7 @@ func cmdMind(args []string) int {
 			fmt.Fprintln(os.Stderr, "usage: noemactl mind import <seed.json>")
 			return exitUsage
 		}
-		raw, err := os.ReadFile(args[1])
+		raw, err := os.ReadFile(args[1]) // #nosec G703 -- operator-chosen file on the operator\'s own machine
 		if err != nil {
 			fmt.Fprintln(os.Stderr, "error:", err)
 			return exitFail

cmd/noemactl/study.go

@@ -67,7 +67,7 @@ func cmdSnapshots(args []string) int {
 		if len(args) < 4 {
 			return exitUsage
 		}
-		raw, err := os.ReadFile(args[2])
+		raw, err := os.ReadFile(args[2]) // #nosec G703 -- operator-chosen file on the operator\'s own machine
 		if err != nil {
 			fmt.Fprintln(os.Stderr, "error:", err)
 			return exitUsage
@@ -202,7 +202,7 @@ func cmdExperiments(args []string) int {
 		if args[1] == "-" {
 			raw, err = io.ReadAll(os.Stdin)
 		} else {
-			raw, err = os.ReadFile(args[1])
+			raw, err = os.ReadFile(args[1]) // #nosec G703 -- operator-chosen file on the operator\'s own machine
 		}
 		if err != nil {
 			fmt.Fprintln(os.Stderr, "error:", err)